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Abstract: Techniques for information hiding have 
become increasingly more sophisticated and 
widespread. Steganalysis has recently received a great 
deal of attention both from law enforcement and the 
media. Attacks and analysis on hidden information may 
take several forms: detecting, extracting, and disabling 
or destroying hidden information. 

This paper provides wavelet based approach for image 
Steganalysis. The detection scheme of the system can be 
separated in two parts. In the first part, extraction a set 
of statistics, called the feature vector, for the 
investigated image. The second part, using a 
classification algorithm to separate original images 
from stego images by means of their feature vectors. 
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1 Introduction 

In today's digital world, much more versatile and 
practical covers for hiding messages digital 
documents, images, video, and audio files have 
replaced invisible ink and paper. As long as an 
electronic document contains perceptually 
irrelevant or redundant information, it can be used 
as a "cover" to hide secret messages. 
Information hiding is a recently developed 
technique in the information security field and has 
received significant attention from both industry 
and academia. There are two main branches for 
information hiding-steganography and digital 
watermarking. The main purpose of steganography 
is to convey messages secretly by concealing the 
very existence of messages, while digital 
watermarking is mainly used for copyright 
protection of electronic product [1]. 
There are many approaches to hiding the 
embedded file. The embedded image bits can be 



inserted in any order substitution replaces cover 
file bits with embedded file bits. Such substitution 
bits techniques will be more detectable than the 
replacement of others, a smart decision has to be 
made as to which bits would make the best 
candidates for substitution [3]. One of the more 
common approaches to substitution is to replace 
the least significant bits (LSBs) in the cover file. 
This approach is justified by the simple 
observation that changing the LSB results in the 
smallest change in the value of the byte [7]. 
The Discrete Cosine Transform (DCT) is the 
keystone for JPEG compression and it can be 
exploited for information hiding. For such 
technique, specific DCT coefficients are used as 
the basis of the embedded file hiding. The 
coefficients correspond to locations of equal values 
in the quantization table. The embedded file bit is 
encoded in the relative difference between the 
coefficients [4]. 

Other Steganographic techniques, including spread 
spectrum, statistical Steganography, distortion, and 
cover generation, are described in detail in [5]. 
Detection of Steganography, estimation of message 
length[6], and its extraction belong to the field of 
steganalysis. Steganalysis has recently received a 
great deal of attention both from law enforcement 
and the media. Attacks and analysis on hidden 
information may take several forms: detecting, 
extracting, and disabling or destroying hidden 
information. An attacker may also embed counter 
information over the existing hidden 
information[ll]. With digital images as carriers, 
the detection of the presence of hidden messages 
poses significant challenges. Although the 
presence of embedded messages is often 
imperceptible to the human eye, it may 
nevertheless disturb the statistics of an image[12]. 



Research in steganalysis is still in its infancy. The 
main reason for this is that in its full generality, 
steganalysis is an ill-posed problem: the original 
host data is unknown, the rate of hiding is 
unknown, and the number of steganography 
scheme is large. A review of the view currently 
available steganalysis tools is given in [10]. 
Unfortunately, even the most promising existing 
approaches, such as Stegdetect [12] and the 
supervised learning framework[8], have drawbacks 
that limit their practical use; which are: - 

- Existing steganalysis methods are based on 
heuristics, and the given steganography method, 
there is no systematic approach for designing a 
steganalysis method. 

- Every steganalysis method has some parameters 
to be chosen, which determine the performance of 
the method. Ideally, the test parameters should be 
chosen purely on the basis of the data to meet the 
required performance. 

- Due to the lack of a theoretical foundation, it is 
not known how current steganalysis test compare 
with "optimum" test. 

The aim of this paper is to provide wavelet based 
approach for image Steganalysis. The detection 
scheme of the system can be separated in two 
parts. In the first part, extraction a set of statistics, 
called the feature vector, for the investigated 
image. The second part, using a classification 
algorithm to separate original images from stego 
images by means of their feature vectors. 

2 The Proposed System for Image 
Steganalysis 

The Proposed System given in Figure 1 can be 
divided up to three parts as follows :- 

(1) . Stego Image Preprocessing 

(2) . Features Extraction and Analysis 
Processes 

(3) . Discrimination Processes 

In our system, we considered the LSB 
steganography approach to be used in 
implementing the information hiding task, hence 
the input signal to our system is the suspected 
signal resulted from hiding process. 

2.1 Stego Image Preprocessing 

Preprocessing algorithm, techniques and operators 
are used to perform initial processing that makes 
the primary data reduction and analysis task easier. 
In our system it represent opening the suspected 
image that will be tested in the system as the input 
image. The images are saved as BMP format. 



Generally, Images come in different sizes and 
different Aspect ratio; therefore, we will scale the 
images into uniform size. Each image will be 
scaled to power of two (i.e. 48*48) so to put in a 
uniform size, and for both the suspected and the 
original image. 

The data at the BMP file is stored as reverse 
sequence; we can notice them when viewing the 
BMP image it will appear from the bottom of the 
image. So reordering the data to make it 
appropriate to processing. 

2.2 Feature Extraction and analysis Processes 

Feature extraction refers to the process of forming 
a new set of features from the original and 
suspected features set, and find a mapping that 
reduces the dimensionality of pattern by extraction 
some numerical measurements from raw input 
pattern. There is no well-develop theory feature 
extraction; most is application oriented. 
The extraction of feature vector are derived from 
the wavelet transformation process, For each 
suspected and original image, theses features are 
coefficients produced in this transformation and 
assumed to be fixed, do not changed after several 
image processing operation. 

There are different types of wavelet 
transformations depending on the bases functions 
used in the transformation, in our work, Haar 
transformation is used to implement wavelet 
transformation. The Haar bases vectors are:- 
Lowpass : J_[n] ,Highpass : i ^ ^ 

Decompose a given image with 2-D wavelet 
transform into 4 images, as indicated in Figure 2. a 
the image is divided into four subbands after 
wavelet transform: horizontal, vertical, diagonal 
subimages, and low resolution subimages, which 
can be viewed as tree in Figure 2.b. 

2.3 Discrimination Processes 

After specifying the features vector by performing 
feature extraction and analysis, methods for 
comparing two features vectors need to be 
determined. These methods are either to measure 
the differences between the two or measure the 
similarity. These are the Statistical Tests. 

3 Experimental Results and Discussion 

This part concerned with experimental results for 
samples of images being tested (as discussed 
previously, several images are taken as shown 



Figure 3, where these images have different sizes 
and type BMP with 24-BPP.The test is done on 
BMP cover image and BMP image as stego object 
in the LSB modification And a text file in the S- 
Tool . These BMP are 24 bits true color. Types of 
hiding were used LSB and S-Tool and adding a 
simple noise. 

Firstly the system were tested with several 
samples, the images are Sandy bell that has a stego 
object using (LSB), Sandy bell2 has a stego object 
using (Stool) [9], Duck with no hidden information, 
drip with noise and some images with LSB, S-Tool 
, clear ...etc. Table 1 shows the result of the 
comparisons of several images. 
In the first step Table 1 represent the statistical 
tests (AD, MSE, SNR, PSNR, NCC, CQ), these 
test are applied on different stego objects and the 
result are differ from image to image depending on 
the Steganography algorithm that used on 
insertion. 

Then the Figure 4 shows the order statistics (Mean, 
Variance, Kurtosis, Skewness) for the Image 
Sandy that has hidden information using LSB 
modification .You can notice the differences 
between those two images. Where the statistics is 
little different and seems to be the same but when 
you focus you can notice it. 

4 Conclusions 

The following are some concluded remarks of the 
proposed system: - 

1 . Using statistical test is a good idea to detect the 
changing in image when original image is 
available. 

2. The system needs to save only the features 
vectors that need only several kilobytes per 
image. 

3. Using wavelet features give better results. 
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Table 1 : comparison of several tested images in the proposed system 
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Figure 1 : The overall Proposed System Model. 
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Figure 2: a. 2-D wavelet Transform, b. Tree presentation of 2-D wavelet Transform. 









Figure 3: Set of images 
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Figure 4: the order statistics 



